CVE-2026-49906 — Vulnerability intelligence
—
Published:
- CVSS
- 7.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.